AZL-83009

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-83009.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-83009
Upstream
Published
2026-04-18T00:16:37Z
Modified
2026-08-30T05:24:52Z
Summary
CVE-2026-40336 affecting package libgphoto2 2.5.31-1
Details

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.

References

Affected packages

Azure Linux:3 / libgphoto2

Package

Name
libgphoto2
Purl
pkg:rpm/azure-linux/libgphoto2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
2.5.31-1

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-83009.json"